IVPN WIREGURD HOW TO
IVPN WIREGURD INSTALL
IVPN WIREGURD MANUAL

You should choose an address range that falls outside the range of your other networks you have set up in OPNsense. This is essentially the same behavior as any other interface in OPNsense when Unbound DNS is enabled on the interface. If you have Unbound DNS in OPNsense set at the default behavior of being applied to “All” interfaces or you have the WireGuard interface selected as one of the interfaces that uses Unbound DNS, it will use the WireGuard tunnel address as the DNS server, which in our example will be 10.0.0.1. I assumed that would be the case similar to most other hosted services, but after receiving information about how the WireGuard protocol works I now know that authentication is required before any response is sent back to the client.

Do not assume if you leave it blank that it will use the default port!Īmendment: In my original post, I stated that changing the default port to something different would reduce port scanning traffic since many scanners simply check the default ports and could potentially reduce the likelihood of the VPN being attacked (although I have not yet heard of any WireGuard VPN breaches). I tried leaving it blank to test if I could connect to the server, and I was unable to do so. Even if you plan to use the default port, you must enter 51820.

Leave the “Public Key” and “Private Key” blank as they will be automatically generated when you click “Save”. Click the “+” button to add a new WireGuard server.Ĭlick the “Enabled” checkbox. Go to the “VPN > WireGuard” page and click the “Local” tab. Configure the WireGuard VPN ServerĪfter installing the plugin, let us start configuring the WireGuard VPN Server.

IVPN WIREGURD INSTALL

If you install the kernel version of WireGuard, it will still use the same web interface as the Go version so the steps in the guide should still be applicable. You may want to use the kernel version if your bandwidth is approaching 1 Gbps or perhaps you have a weak CPU in your router that you need every ounce of performance by running WireGuard in the kernel of the OS.

IVPN WIREGURD MANUAL

A kernel version is available, but it currently requires manual installation. The default WireGuard plugin uses the Go version of the WireGuard implementation which is less performant than the kernel version of WireGuard. I imagine many of the same concepts apply but your mileage may vary.

IVPN WIREGURD HOW TO

Please keep in mind that in this guide I am describing how to connect securely to your home network remotely via WireGuard in OPNsense and not how to connect OPNsense to an external WireGuard VPN provider such as Mullvad. I will refer to the WireGuard installation on OPNsense as the WireGuard server rather than a “peer” to make it more clear which device I am configuring unless I am describing various elements on the user interface so that I am consistent with the terminology used by WireGuard. Therefore, the WireGuard VPN in OPNsense is simply a peer which other WireGuard-enabled devices (peers) on your network may connect. Every device connecting via WireGuard is considered a peer or endpoint. WireGuard uses the terminology of peers and endpoints rather than clients and servers. The handshake avoids a denial of service vulnerability created by allowing any state to be created in response to packets that have not yet been authenticated.”ĭevices that connect via WireGuard are referred to as “peer” devices. In fact, the server does not even respond at all to an unauthorized client it is silent and invisible. “We require authentication in the first handshake message sent because it does not require allocating any state on the server for potentially unauthentic messages. Here is a quote from the WireGuard documentation: That is a nice security benefit of WireGuard. The WireGuard protocol is designed to only respond to clients which present a valid key so WireGuard cannot be port scanned like other services since it requires authentication before any response is sent. WireGuard is similar to a SSH server that is configured to use keys since only devices which share their cryptographic keys with one another are able to connect via an encrypted tunnel. It seemed to be more difficult than configuring OpenVPN even though there are fewer options to configure in WireGuard (since WireGuard takes care of many details behind the scenes). I found setting up WireGuard in OPNsense to be more difficult than I anticipated when I was first learning how to properly configure the service.

WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up once you understand how it functions in OPNsense.

Ivpn wiregurd